Analysis
- max time kernel
151s - max time network
196s - platform
windows7_x64 - resource
win7v20210408 - submitted
29/05/2021, 16:51
Static task
static1
Behavioral task
behavioral1
Sample
3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe
- Size 784KB
- Sample210529-esqevdhhcs
- SHA256 c02d6bf7da26beacb94946e5eeeef6fe1ecdcea66f3e1c517cebd9c06b9c19b5
- MD5 3df331c6547dae5ecd7d79addba9ecb5
- SHA1 b99a6e536474238b568c2687bef4a6eeab77f00c
- SHA512 c3c9a9f168602e2c3d51b7c687f66e6d86fc904ca3d7c08a798d87ee1ceb70475a239be2edc95bb44ebee615a9a520ee6092beb0c242ae76ae0c306907c6b3fe
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- CyberGate Payload 4 IoCs
resource yara_rule behavioral1/memory/2044-62-0x0000000000400000-0x0000000000450000-memory.dmp family_cybergate behavioral1/memory/2044-63-0x000000000040BBF4-mapping.dmp family_cybergate behavioral1/memory/2044-65-0x0000000000400000-0x0000000000450000-memory.dmp family_cybergate behavioral1/memory/460-148-0x000000000040BBF4-mapping.dmp family_cybergate - Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\Winlogui\\csrss.exe" 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\Winlogui\\csrss.exe" 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE - Executes dropped EXE 2 IoCs
pid Process 316 csrss.exe 460 csrss.EXE - Modifies Installed Components in the registry 2 TTPs
-
resource yara_rule behavioral1/memory/1224-108-0x0000000024080000-0x00000000240E2000-memory.dmp upx - Loads dropped DLL 2 IoCs
pid Process 1996 explorer.exe 1996 explorer.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\Winlogui\\csrss.exe" 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Smart Essentials = "C:\\Windows\\Winlogui\\csrss.exe" 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini explorer.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1092 set thread context of 2044 1092 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 29 PID 316 set thread context of 460 316 csrss.exe 33 - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Winlogui\ explorer.exe File opened for modification C:\Windows\Winlogui\csrss.EXE csrss.exe File created C:\Windows\Winlogui\csrss.exe 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE File opened for modification C:\Windows\Winlogui\csrss.exe 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE File opened for modification C:\Windows\Winlogui\csrss.exe explorer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1996 explorer.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 1996 explorer.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1996 explorer.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1092 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 316 csrss.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1092 wrote to memory of 2044 1092 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 29 PID 1092 wrote to memory of 2044 1092 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 29 PID 1092 wrote to memory of 2044 1092 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 29 PID 1092 wrote to memory of 2044 1092 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 29 PID 1092 wrote to memory of 2044 1092 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 29 PID 1092 wrote to memory of 2044 1092 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 29 PID 1092 wrote to memory of 2044 1092 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 29 PID 1092 wrote to memory of 2044 1092 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 29 PID 1092 wrote to memory of 2044 1092 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 29 PID 1092 wrote to memory of 2044 1092 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 29 PID 1092 wrote to memory of 2044 1092 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 29 PID 1092 wrote to memory of 2044 1092 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 29 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14 PID 2044 wrote to memory of 1212 2044 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 14
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe"C:\Users\Admin\AppData\Local\Temp\3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE"C:\Users\Admin\AppData\Local\Temp\3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE"3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵PID:1224
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1996 -
C:\Windows\Winlogui\csrss.exe"C:\Windows\Winlogui\csrss.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:316 -
C:\Windows\Winlogui\csrss.EXE"C:\Windows\Winlogui\csrss.EXE"6⤵
- Executes dropped EXE
PID:460
-
-
-
-
-